﻿Imports DotNetNuke.Security
Imports System.Text.RegularExpressions
Imports System.Web

Namespace DotNetNuke.Modules.ActiveForums
    Partial Public Class Utilities
        Public Class Text
            Public Shared Function CheckSqlString(ByVal input As String) As String
                input = input.ToUpperInvariant
                input = input.Replace("\", "")
                input = input.Replace("[", "")
                input = input.Replace("]", "")
                input = input.Replace("(", "")
                input = input.Replace(")", "")
                input = input.Replace("{", "")
                input = input.Replace("}", "")
                input = input.Replace("'", "''")
                input = input.Replace("UNION", "")
                input = input.Replace("TABLE", "")
                input = input.Replace("WHERE", "")
                input = input.Replace("DROP", "")
                input = input.Replace("EXECUTE", "")
                input = input.Replace("EXEC ", "")
                input = input.Replace("FROM ", "")
                input = input.Replace("CMD ", "")
                input = input.Replace(";", "")
                input = input.Replace("--", "")
                'input = input.Replace("""", """""")
                Return input
            End Function
            Public Shared Function FilterScripts(ByVal text As String) As String
                If String.IsNullOrEmpty(text) Then
                    Return String.Empty
                End If
                Dim objPortalSecurity As New PortalSecurity()
                Try
                    text = objPortalSecurity.InputFilter(text, PortalSecurity.FilterFlag.NoScripting)
                Catch ex As Exception

                End Try

                Dim pattern As String = "<script.*/*>|</script>|<[a-zA-Z][^>]*=['""]+javascript:\w+.*['""]+>|<\w+[^>]*\son\w+=.*[ /]*>"
                text = Regex.Replace(text, pattern, String.Empty, RegexOptions.IgnoreCase)
                Dim strip As String = "/*,*/,alert,document.,window.,eval(,eval[,@import,vbscript,javascript,jscript,msgbox"
                For Each s As String In strip.Split(CChar(","))
                    If text.ToUpper.Contains(s.ToUpper) Then
                        text = text.Replace(s.ToUpper, String.Empty)
                        text = text.Replace(s, String.Empty)
                    End If
                Next
                Return text
            End Function
            Public Shared Function RemoveHTML(ByVal sText As String) As String
                If String.IsNullOrEmpty(sText) Then
                    Return String.Empty
                End If
                sText = HttpUtility.HtmlDecode(sText)
                sText = HttpUtility.UrlDecode(sText)
                sText = sText.Trim
                If String.IsNullOrEmpty(sText) Then
                    Return String.Empty
                End If
                Dim objPortalSecurity As New PortalSecurity()
                sText = objPortalSecurity.InputFilter(sText, PortalSecurity.FilterFlag.NoScripting)
                sText = FilterScripts(sText)
                Dim strip As String = "/*,*/,alert,document.,window.,eval(,eval[,src=,rel=,href=,@import,vbscript,javascript,jscript,msgbox,<style"
                For Each s As String In strip.Split(CChar(","))
                    If sText.ToUpper.Contains(s.ToUpper) Then
                        sText = sText.Replace(s.ToUpper, String.Empty)
                        sText = sText.Replace(s, String.Empty)
                    End If
                Next
                Dim pattern As String = "<(.|\n)*?>"
                sText = Regex.Replace(sText, pattern, String.Empty, RegexOptions.IgnoreCase)
                sText = HttpUtility.HtmlEncode(sText)
                'sText = HttpUtility.UrlEncode(sText)
                Return sText
            End Function
        End Class
    End Class

End Namespace

